Outsourcing of Risk - Assurance Review 2020/21 - IT Patching and Maintenance

NS&I has an outsourced customer servicing model which, in addition, provides IT and infrastructure services. These services are provided to NS&I by Atos. As part of this agreement Atos are responsible for maintaining and keeping up to date the servers and software used by both their own sales processing and customer servicing teams, and by NS&I staff.

IT patching is split into two main areas:

• Patching of the server estate used to service operations, overseen by NS&I's IS and Information Assurance team; • Patching of security vulnerability overseen by the IT Security team.

NS&I wishes to appoint a suitable firm to conduct a review of Atos's patch management. The scope of this review will focus on the management of server estate patching and will exclude security vulnerabilities.